The origins of Spyynich

Was the surveillance software installed on the newly-elected mayor’s computer by Saanich staff a case of tit for tat?

LATE LAST MAY I received an interesting phone call from Dr Gerald Graham. Graham had made a presentation to an August 14, 2013 CRD Board meeting at which an extraordinary incident had occurred minutes before he spoke. When Graham phoned, he told me he had filed an FOI for whatever investigation of the incident had been undertaken by the CRD. He told me there was no doubt at the CRD about who was responsible for the incident and that the FOI records he obtained showed this. When I asked if he would share those records he was non-committal. In the end he didn’t share them. I’ll come back to Graham and draw a connection to the infamous installation of surveillance software on Saanich Mayor Richard Atwell’s computer, but first let me tell you about what happened at that 2013 CRD Board meeting.

The matter being discussed was the CRD’s proposed $783-million sewage treatment plan. Twenty-one individuals had pre-registered to address the board on the merits of a motion by Saanich Councillor Vic Derman. Derman was proposing that the CRD “Initiate an extensive, independent review of the current [McLoughlin Point] project.” His motion set out specific objectives for that review.

The very first presentation on the schedule of speakers was a video by East Sooke fisherman and diver Allan Crow, a proponent of sewage treatment. Crow’s video had been previously uploaded by CRD staff to a laptop used to include visual presentations from the public at such meetings. At that point in the meeting the presentations of all the participants who were going to use the overhead projection system had been loaded onto the laptop. Crow started his video. The CRD’s minutes for the meeting provide a brief outline of what happened: “During the presentation it became apparent that the video had been tampered with. The Chair asked that Mr Crow return at the end of the delegation list to play an original version of the video.”

Times Colonist reporter Rob Shaw’s account of the incident was more fulsome: “A local diver tried to play a video for the board of underwater conditions near a sewage outfall. But unknown opponents secretly altered his file on the CRD computer, so the words ‘misleading’ were superimposed on the video.” Shaw went on to observe: “CRD chairman Alastair Bryson stopped the presentation and asked the perpetrator to step forward. But no one did.”

Gerald Graham was scheduled to speak immediately after Crow’s aborted video and then his presentation was followed by 20 others, including Crow’s unaltered video at the end. In between, among the speakers who used the CRD’s laptop to provide a visual component to their presentation, was Richard Atwell. At the time, Atwell was a community activist well known for doggedly critiquing the CRD’s every move on its sewage treatment plan.

Let me go back to Graham’s phone call. As I mentioned above, Graham told me he had filed an FOI for any investigation conducted by the CRD into the incident. Graham said the CRD knew who had tampered with the video. He volunteered this information after obliquely referring to the Saanich spyware stories I had written. I was intrigued. Was the incident involving Crow’s video somehow linked to the installation of spyware on the newly-elected mayor’s computer?

I eventually filed my own FOI with the CRD for the records Graham had received. What the CRD released included an email sent on August 15, 2013 to several CRD staff that described what they believed had happened: “We suspect the person downloaded the video from Youtube ahead of time (they knew the video was there), made the edits, and then deleted the version we had on our laptop and replaced it with their version. Not nice.”

The records also show that, two weeks later, a second CRD employee stated, “…the delegation simply came up to the laptop and did what he wanted to under the guise of getting ready, even though his presentation had already been placed on the laptop.”

It should be mentioned that the CRD emails do not name who “he” was, but with careful consideration of the short list of people who made presentations involving the CRD’s laptop at that meeting, and knowing a little about each of those people, it would be challenging to not come to the conclusion that “he” was Richard Atwell. Given the context of Graham’s phone call to me, it was evident that Graham himself had come to that conclusion. How many other people believed that Atwell had tampered with Crow’s presentation? The email records show that upwards of 13 CRD employees were made aware of the details of the CRD’s investigation into the incident.

I recently spoke with Mayor Atwell and told him about the CRD’s investigation and Graham’s FOI. I asked him if he’d switched Crow’s video files at that 2013 CRD board meeting. Atwell was unwilling to either confirm or deny that he was the person who made the switch.

The records provided to me by the CRD also show that on the day after the video incident, Saanich Councillor Judy Brownoff asked CRD staff about what steps they would be taking to secure the presentation laptop. It’s not hard to imagine that other CRD directors made similar inquiries and that with so many CRD staff aware of the details of the investigation, Richard Atwell, citizen activist, had quickly gained a level of notoriety amongst local government civil servants and politicians as—to use Rob Shaw’s words—“the perpetrator.”

Just 15 months after the video incident, Atwell was—to the astonishment of many—elected mayor of Saanich.

Within six days of that election, employee monitoring software had been installed on the mayor-elect’s designated computer, ready to record every single keystroke he made. As well, his computer was configured to prevent him from accessing the District’s corporate intranet. On top of that, access to the departmental drives that were formerly available to Mayor Frank Leonard were denied to Mayor Atwell.

Why did Saanich staff feel such an urgent need to isolate, confine and monitor the new mayor’s computer activity even before he’d spent a minute in office? Had they been warned about Atwell’s suspected involvement in the video tampering incident?

The official answer to that question came after the spyware had been outed. The District’s Director of Corporate Services Laura Ciarniello was asked by BC’s Information and Privacy Commissioner Elizabeth Denham why the software had been installed. Denham reported: “According to Ciarniello, the motivation for this renewed focus on IT security was the perception by District Directors that the new mayor was experienced in the area of IT and would be able to identify and criticize current weaknesses in the District’s IT security.”

But that rationale has been limp from the beginning. It requires a suspension of common sense to believe that such a hostile initiative—secretly installing spyware on the newly-elected mayor’s computer—was put in place to avoid criticism. On the other hand, with rumours about Atwell’s involvement in the 2013 video incident circulating from CRD staff to Saanich politicians and then to Saanich bureaucrats—well it’s not so difficult to understand that the real motivation could have been the fear that Atwell might exploit those “current weaknesses.”

This theory is lent credence by the report of “Whistleblower,” a Saanich IT division employee involved in installing the surveillance software. Concerned about the unethical nature of such covert surveillance, he wrote down his recollection of what he’d been told by Saanich’s Assistant Manager of IT John Proc: “John Proc came to us…with a directive that had just come down to IT in regards to installing monitoring software on the mayor’s computer. He said, ‘They are nervous about the new mayor. We’re installing it on the directors’ computers as well to make it [look like] it is not targeted’…”

After repeatedly asking his managers if the mayor had been informed about the spyware, and not receiving an affirmative response, Whistleblower took his concerns—and that recollection—to a former colleague, who then contacted Atwell. On January 12, 2015, the mayor announced at a press conference that, among other things, he was being spied on by his own staff.

Atwell’s claim was immediately countered by a press release issued by Saanich councillors on January 13, which stated: “This installation was in response to the conclusions of a May 2014 independent, external audit of the District of Saanich computer system. Recommendations from the May 2014 audit included the installation of security software.”

It was later revealed by Denham, however, that the security audit’s author “did not make any such recommendation nor did he intend to make any recommendation that could be interpreted to recommend the installation of monitoring software such as Spector 360.” Indeed, Denham’s investigation concluded that the installation of the monitoring software had likely lowered the security of the District’s computer network.

All this raises questions about transparency on everyone’s part, including Atwell, but it also raises the question of whether any elected Saanich official played a direct, supportive role in Ciarniello’s decision to install spyware on the incoming mayor’s computer. If so, that would have represented the kind of politicization of a civil servant’s role that was, by all accounts, common in East Germany in 1984 but which most people, one would hope, would agree has no place at all in Saanich.